chef 16.4.35 → 16.6.14

data/lib/chef/resource/chef_client_systemd_timer.rb

@@ -15,7 +15,7 @@
 #
 
 require_relative "../resource"
-require_relative "../dist"
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 
 class Chef
   class Resource
@@ -24,42 +24,42 @@ class Chef
 
       provides :chef_client_systemd_timer
 
-      description "Use the **chef_client_systemd_timer** resource to setup the #{Chef::Dist::PRODUCT} to run as a systemd timer."
+      description "Use the **chef_client_systemd_timer** resource to setup the #{ChefUtils::Dist::Infra::PRODUCT} to run as a systemd timer."
       introduced "16.0"
       examples <<~DOC
-      **Setup #{Chef::Dist::PRODUCT} to run using the default 30 minute cadence**:
+      **Setup #{ChefUtils::Dist::Infra::PRODUCT} to run using the default 30 minute cadence**:
 
       ```ruby
-      chef_client_systemd_timer "Run #{Chef::Dist::PRODUCT} as a systemd timer"
+      chef_client_systemd_timer 'Run #{ChefUtils::Dist::Infra::PRODUCT} as a systemd timer'
       ```
 
-      **Run #{Chef::Dist::PRODUCT} every 1 hour**:
+      **Run #{ChefUtils::Dist::Infra::PRODUCT} every 1 hour**:
 
       ```ruby
-      chef_client_systemd_timer "Run #{Chef::Dist::PRODUCT} every 1 hour" do
-        interval "1hr"
+      chef_client_systemd_timer 'Run #{ChefUtils::Dist::Infra::PRODUCT} every 1 hour' do
+        interval '1hr'
       end
       ```
 
-      **Run #{Chef::Dist::PRODUCT} with extra options passed to the client**:
+      **Run #{ChefUtils::Dist::Infra::PRODUCT} with extra options passed to the client**:
 
       ```ruby
-      chef_client_systemd_timer "Run an override recipe" do
-        daemon_options ["--override-runlist mycorp_base::default"]
+      chef_client_systemd_timer 'Run an override recipe' do
+        daemon_options ['--override-runlist mycorp_base::default']
       end
       ```
       DOC
 
       property :job_name, String,
         description: "The name of the system timer to create.",
-        default: Chef::Dist::CLIENT
+        default: ChefUtils::Dist::Infra::CLIENT
 
       property :description, String,
         description: "The description to add to the systemd timer. This will be displayed when running `systemctl status` for the timer.",
-        default: "#{Chef::Dist::PRODUCT} periodic execution"
+        default: "#{ChefUtils::Dist::Infra::PRODUCT} periodic execution"
 
       property :user, String,
-        description: "The name of the user that #{Chef::Dist::PRODUCT} runs as.",
+        description: "The name of the user that #{ChefUtils::Dist::Infra::PRODUCT} runs as.",
         default: "root"
 
       property :delay_after_boot, String,
@@ -71,7 +71,7 @@ class Chef
         default: "30min"
 
       property :splay, String,
-        description: "A interval between 0 and X to add to the interval so that all #{Chef::Dist::CLIENT} commands don't execute at the same time. This is expressed as a systemd time span such as `300seconds`, `1hr`, or `1m`. See <https://www.freedesktop.org/software/systemd/man/systemd.time.html> for a complete list of allowed time span values.",
+        description: "A interval between 0 and X to add to the interval so that all #{ChefUtils::Dist::Infra::CLIENT} commands don't execute at the same time. This is expressed as a systemd time span such as `300seconds`, `1hr`, or `1m`. See <https://www.freedesktop.org/software/systemd/man/systemd.time.html> for a complete list of allowed time span values.",
         default: "5min"
 
       property :accept_chef_license, [true, false],
@@ -79,25 +79,31 @@ class Chef
         default: false
 
       property :run_on_battery, [true, false],
-        description: "Run the timer for #{Chef::Dist::PRODUCT} if the system is on battery.",
+        description: "Run the timer for #{ChefUtils::Dist::Infra::PRODUCT} if the system is on battery.",
         default: true
 
       property :config_directory, String,
         description: "The path of the config directory.",
-        default: Chef::Dist::CONF_DIR
+        default: ChefConfig::Config.etc_chef_dir
 
       property :chef_binary_path, String,
-        description: "The path to the #{Chef::Dist::CLIENT} binary.",
-        default: "/opt/#{Chef::Dist::DIR_SUFFIX}/bin/#{Chef::Dist::CLIENT}"
+        description: "The path to the #{ChefUtils::Dist::Infra::CLIENT} binary.",
+        default: "/opt/#{ChefUtils::Dist::Infra::DIR_SUFFIX}/bin/#{ChefUtils::Dist::Infra::CLIENT}"
 
       property :daemon_options, Array,
-        description: "An array of options to pass to the #{Chef::Dist::CLIENT} command.",
+        description: "An array of options to pass to the #{ChefUtils::Dist::Infra::CLIENT} command.",
         default: lazy { [] }
 
       property :environment, Hash,
         description: "A Hash containing additional arbitrary environment variables under which the systemd timer will be run in the form of `({'ENV_VARIABLE' => 'VALUE'})`.",
         default: lazy { {} }
 
+      property :cpu_quota, [Integer, String],
+        description: "The systemd CPUQuota to run the #{ChefUtils::Dist::Infra::CLIENT} process with. This is a percentage value of the total CPU time available on the system. If the system has more than 1 core this may be a value greater than 100.",
+        introduced: "16.5",
+        coerce: proc { |x| Integer(x) },
+        callbacks: { "should be a positive Integer" => proc { |v| v > 0 } }
+
       action :add do
         systemd_unit "#{new_resource.job_name}.service" do
           content service_content
@@ -127,7 +133,7 @@ class Chef
         # @return [String]
         #
         def chef_client_cmd
-          cmd = "#{new_resource.chef_binary_path}"
+          cmd = new_resource.chef_binary_path.dup
           cmd << " #{new_resource.daemon_options.join(" ")}" unless new_resource.daemon_options.empty?
           cmd << " --chef-license accept" if new_resource.accept_chef_license
           cmd << " -c #{::File.join(new_resource.config_directory, "client.rb")}"
@@ -171,6 +177,7 @@ class Chef
           }
 
           unit["Service"]["ConditionACPower"] = "true" unless new_resource.run_on_battery
+          unit["Service"]["CPUQuota"] = new_resource.cpu_quota if new_resource.cpu_quota
           unit["Service"]["Environment"] = new_resource.environment.collect { |k, v| "\"#{k}=#{v}\"" } unless new_resource.environment.empty?
           unit
         end

data/lib/chef/resource/chef_client_trusted_certificate.rb

@@ -0,0 +1,101 @@
+#
+# Copyright:: Copyright (c) Chef Software Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+require_relative "../resource"
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
+
+class Chef
+  class Resource
+    class ChefClientTrustedCertificate < Chef::Resource
+      unified_mode true
+
+      provides :chef_client_trusted_certificate
+
+      description "Use the **chef_client_trusted_certificate** resource to add certificates to #{ChefUtils::Dist::Infra::PRODUCT}'s trusted certificate directory. This allows the #{ChefUtils::Dist::Infra::PRODUCT} to communicate with internal encrypted resources without errors."
+      introduced "16.5"
+      examples <<~DOC
+      **Trust a self signed certificate**:
+
+      ```ruby
+      chef_client_trusted_certificate 'self-signed.badssl.com' do
+        certificate <<~CERT
+        -----BEGIN CERTIFICATE-----
+        MIIDeTCCAmGgAwIBAgIJAPziuikCTox4MA0GCSqGSIb3DQEBCwUAMGIxCzAJBgNV
+        BAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNp
+        c2NvMQ8wDQYDVQQKDAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTAeFw0x
+        OTEwMDkyMzQxNTJaFw0yMTEwMDgyMzQxNTJaMGIxCzAJBgNVBAYTAlVTMRMwEQYD
+        VQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1TYW4gRnJhbmNpc2NvMQ8wDQYDVQQK
+        DAZCYWRTU0wxFTATBgNVBAMMDCouYmFkc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEB
+        BQADggEPADCCAQoCggEBAMIE7PiM7gTCs9hQ1XBYzJMY61yoaEmwIrX5lZ6xKyx2
+        PmzAS2BMTOqytMAPgLaw+XLJhgL5XEFdEyt/ccRLvOmULlA3pmccYYz2QULFRtMW
+        hyefdOsKnRFSJiFzbIRMeVXk0WvoBj1IFVKtsyjbqv9u/2CVSndrOfEk0TG23U3A
+        xPxTuW1CrbV8/q71FdIzSOciccfCFHpsKOo3St/qbLVytH5aohbcabFXRNsKEqve
+        ww9HdFxBIuGa+RuT5q0iBikusbpJHAwnnqP7i/dAcgCskgjZjFeEU4EFy+b+a1SY
+        QCeFxxC7c3DvaRhBB0VVfPlkPz0sw6l865MaTIbRyoUCAwEAAaMyMDAwCQYDVR0T
+        BAIwADAjBgNVHREEHDAaggwqLmJhZHNzbC5jb22CCmJhZHNzbC5jb20wDQYJKoZI
+        hvcNAQELBQADggEBAGlwCdbPxflZfYOaukZGCaxYK6gpincX4Lla4Ui2WdeQxE95
+        w7fChXvP3YkE3UYUE7mupZ0eg4ZILr/A0e7JQDsgIu/SRTUE0domCKgPZ8v99k3A
+        vka4LpLK51jHJJK7EFgo3ca2nldd97GM0MU41xHFk8qaK1tWJkfrrfcGwDJ4GQPI
+        iLlm6i0yHq1Qg1RypAXJy5dTlRXlCLd8ufWhhiwW0W75Va5AEnJuqpQrKwl3KQVe
+        wGj67WWRgLfSr+4QG1mNvCZb2CkjZWmxkGPuoP40/y7Yu5OFqxP5tAjj4YixCYTW
+        EVA0pmzIzgBg+JIe3PdRy27T0asgQW/F4TY61Yk=
+        -----END CERTIFICATE-----
+        CERT
+      end
+      ```
+      DOC
+
+      property :cert_name, String, name_property: true,
+        description: "The name to use for the certificate file on disk. If not provided the name of the resource block will be used instead."
+
+      property :certificate, String, required: [:add],
+        description: "The text of the certificate file including the BEGIN/END comment lines."
+
+      action :add do
+        unless ::Dir.exist?(Chef::Config[:trusted_certs_dir])
+          directory Chef::Config[:trusted_certs_dir] do
+            mode "0640"
+            recursive true
+          end
+        end
+
+        file cert_path do
+          content new_resource.certificate
+          mode "0640"
+        end
+      end
+
+      action :remove do
+        file cert_path do
+          action :delete
+        end
+      end
+
+      action_class do
+        #
+        # The path to the string on disk
+        #
+        # @return [String]
+        #
+        def cert_path
+          path = ::File.join(Chef::Config[:trusted_certs_dir], new_resource.cert_name)
+          path << ".pem" unless path.end_with?(".pem")
+          path
+        end
+      end
+    end
+  end
+end

data/lib/chef/resource/chef_gem.rb

@@ -18,7 +18,7 @@
 
 require_relative "package"
 require_relative "gem_package"
-require_relative "../dist"
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 
 class Chef
   class Resource
@@ -27,27 +27,27 @@ class Chef
       provides :chef_gem
 
       description <<~DESC
-        Use the **chef_gem** resource to install a gem only for the instance of Ruby that is dedicated to the #{Chef::Dist::CLIENT}.
+        Use the **chef_gem** resource to install a gem only for the instance of Ruby that is dedicated to the #{ChefUtils::Dist::Infra::CLIENT}.
         When a gem is installed from a local file, it must be added to the node using the **remote_file** or **cookbook_file** resources.
 
         The **chef_gem** resource works with all of the same properties and options as the **gem_package** resource, but does not
-        accept the `gem_binary` property because it always uses the `CurrentGemEnvironment` under which the `#{Chef::Dist::CLIENT}` is
+        accept the `gem_binary` property because it always uses the `CurrentGemEnvironment` under which the `#{ChefUtils::Dist::Infra::CLIENT}` is
         running. In addition to performing actions similar to the **gem_package** resource, the **chef_gem** resource does the
         following:
         - Runs its actions immediately, before convergence, allowing a gem to be used in a recipe immediately after it is installed.
         - Runs `Gem.clear_paths` after the action, ensuring that gem is aware of changes so that it can be required immediately after it is installed.
 
-        Warning: The **chef_gem** and **gem_package** resources are both used to install Ruby gems. For any machine on which #{Chef::Dist::PRODUCT} is
+        Warning: The **chef_gem** and **gem_package** resources are both used to install Ruby gems. For any machine on which #{ChefUtils::Dist::Infra::PRODUCT} is
         installed, there are two instances of Ruby. One is the standard, system-wide instance of Ruby and the other is a dedicated instance that is
-        available only to #{Chef::Dist::PRODUCT}.
-        Use the **chef_gem** resource to install gems into the instance of Ruby that is dedicated to #{Chef::Dist::PRODUCT}.
+        available only to #{ChefUtils::Dist::Infra::PRODUCT}.
+        Use the **chef_gem** resource to install gems into the instance of Ruby that is dedicated to #{ChefUtils::Dist::Infra::PRODUCT}.
         Use the **gem_package** resource to install all other gems (i.e. install gems system-wide).
       DESC
 
       examples <<~EXAMPLES
         **Compile time vs. converge time installation of gems**
 
-        To install a gem while #{Chef::Dist::PRODUCT} is configuring the node (the converge phase), set the `compile_time` property to `false`:
+        To install a gem while #{ChefUtils::Dist::Infra::PRODUCT} is configuring the node (the converge phase), set the `compile_time` property to `false`:
         ```ruby
         chef_gem 'right_aws' do
           compile_time false
@@ -63,7 +63,7 @@ class Chef
         end
         ```
 
-        Install MySQL for Chef
+        **Install MySQL gem into #{ChefUtils::Dist::Infra::PRODUCT}***
         ```ruby
         apt_update
 
@@ -84,8 +84,8 @@ class Chef
 
       property :gem_binary, String,
         default: "#{RbConfig::CONFIG["bindir"]}/gem",
-        default_description: "The `gem` binary included with #{Chef::Dist::PRODUCT}.",
-        description: "The path of a gem binary to use for the installation. By default, the same version of Ruby that is used by #{Chef::Dist::PRODUCT} will be used.",
+        default_description: "The `gem` binary included with #{ChefUtils::Dist::Infra::PRODUCT}.",
+        description: "The path of a gem binary to use for the installation. By default, the same version of Ruby that is used by #{ChefUtils::Dist::Infra::PRODUCT} will be used.",
         callbacks: {
           "The `chef_gem` resource is restricted to the current gem environment, use `gem_package` to install to other environments." =>
             proc { |v| v == "#{RbConfig::CONFIG["bindir"]}/gem" },

data/lib/chef/resource/chef_handler.rb

@@ -16,7 +16,7 @@
 #
 
 require_relative "../resource"
-require_relative "../dist"
+require "chef-utils/dist" unless defined?(ChefUtils::Dist)
 
 class Chef
   class Resource
@@ -25,8 +25,153 @@ class Chef
 
       provides(:chef_handler) { true }
 
-      description "Use the **chef_handler** resource to install or uninstall reporting/exception handlers."
+      description "Use the **chef_handler** resource to enable handlers during a #{ChefUtils::Dist::Infra::PRODUCT} run. The resource allows arguments to be passed to #{ChefUtils::Dist::Infra::PRODUCT}, which then applies the conditions defined by the custom handler to the node attribute data collected during a #{ChefUtils::Dist::Infra::PRODUCT} run, and then processes the handler based on that data.\nThe **chef_handler** resource is typically defined early in a node's run-list (often being the first item). This ensures that all of the handlers will be available for the entire #{ChefUtils::Dist::Infra::PRODUCT} run."
       introduced "14.0"
+      examples <<~'DOC'
+      **Enable the 'MyHandler' handler**
+
+      The following example shows how to enable a fictional 'MyHandler' handler which is located on disk at `/etc/chef/my_handler.rb`. The handler will be configured to run with Chef Infra Client and will be passed values to the handler's initializer method:
+
+      ```ruby
+      chef_handler 'MyHandler' do
+        source '/etc/chef/my_handler.rb' # the file should already be at this path
+        arguments path: '/var/chef/reports'
+        action :enable
+      end
+      ```
+
+      **Enable handlers during the compile phase**
+
+      ```ruby
+      chef_handler 'Chef::Handler::JsonFile' do
+        source 'chef/handler/json_file'
+        arguments path: '/var/chef/reports'
+        action :enable
+        compile_time true
+      end
+      ```
+
+      **Handle only exceptions**
+
+      ```ruby
+      chef_handler 'Chef::Handler::JsonFile' do
+        source 'chef/handler/json_file'
+        arguments path: '/var/chef/reports'
+        type exception: true
+        action :enable
+      end
+      ```
+
+      **Cookbook Versions (a custom handler)**
+
+      [@juliandunn](https://github.com/juliandunn) created a custom report handler that logs all of the cookbooks and cookbook versions that were used during a Chef Infra Client run, and then reports after the run is complete.
+
+      cookbook_versions.rb:
+
+      The following custom handler defines how cookbooks and cookbook versions that are used during a Chef Infra Client run will be compiled into a report using the `Chef::Log` class in Chef Infra Client:
+
+      ```ruby
+      require 'chef/log'
+
+      module Chef
+        class CookbookVersionsHandler < Chef::Handler
+          def report
+            cookbooks = run_context.cookbook_collection
+            Chef::Log.info('Cookbooks and versions run: #{cookbooks.map {|x| x.name.to_s + ' ' + x.version }}')
+          end
+        end
+      end
+      ```
+
+      default.rb:
+
+      The following recipe is added to the run-list for every node on which a list of cookbooks and versions will be generated as report output after every Chef Infra Client run.
+
+      ```ruby
+      cookbook_file '/etc/chef/cookbook_versions.rb' do
+        source 'cookbook_versions.rb'
+        action :create
+      end
+
+      chef_handler 'Chef::CookbookVersionsHandler' do
+        source '/etc/chef/cookbook_versions.rb'
+        type report: true
+        action :enable
+      end
+      ```
+
+      This recipe will generate report output similar to the following:
+
+      ```
+      [2013-11-26T03:11:06+00:00] INFO: Chef Infra Client Run complete in 0.300029878 seconds
+      [2013-11-26T03:11:06+00:00] INFO: Running report handlers
+      [2013-11-26T03:11:06+00:00] INFO: Cookbooks and versions run: ["cookbook_versions_handler 1.0.0"]
+      [2013-11-26T03:11:06+00:00] INFO: Report handlers complete
+      ```
+
+      **JsonFile Handler**
+
+      The JsonFile handler is available from the `chef_handler` cookbook and can be used with exceptions and reports. It serializes run status data to a JSON file. This handler may be enabled in one of the following ways.
+
+      By adding the following lines of Ruby code to either the client.rb file or the solo.rb file, depending on how Chef Infra Client is being run:
+
+      ```ruby
+      require 'chef/handler/json_file'
+      report_handlers << Chef::Handler::JsonFile.new(path: '/var/chef/reports')
+      exception_handlers << Chef::Handler::JsonFile.new(path: '/var/chef/reports')
+      ```
+
+      By using the `chef_handler` resource in a recipe, similar to the following:
+
+      ```ruby
+      chef_handler 'Chef::Handler::JsonFile' do
+        source 'chef/handler/json_file'
+        arguments path: '/var/chef/reports'
+        action :enable
+      end
+      ```
+
+      After it has run, the run status data can be loaded and inspected via Interactive Ruby (IRb):
+
+      ```
+      irb(main):002:0> require 'json' => true
+      irb(main):003:0> require 'chef' => true
+      irb(main):004:0> r = JSON.parse(IO.read('/var/chef/reports/chef-run-report-20110322060731.json')) => ... output truncated
+      irb(main):005:0> r.keys => ['end_time', 'node', 'updated_resources', 'exception', 'all_resources', 'success', 'elapsed_time', 'start_time', 'backtrace']
+      irb(main):006:0> r['elapsed_time'] => 0.00246
+      ```
+
+      Register the JsonFile handler
+
+      ```ruby
+      chef_handler 'Chef::Handler::JsonFile' do
+        source 'chef/handler/json_file'
+        arguments path: '/var/chef/reports'
+        action :enable
+      end
+      ```
+
+      **ErrorReport Handler**
+
+      The ErrorReport handler is built into Chef Infra Client and can be used for both exceptions and reports. It serializes error report data to a JSON file. This handler may be enabled in one of the following ways.
+
+      By adding the following lines of Ruby code to either the client.rb file or the solo.rb file, depending on how Chef Infra Client is being run:
+
+      ```ruby
+      require 'chef/handler/error_report'
+      report_handlers << Chef::Handler::ErrorReport.new
+      exception_handlers << Chef::Handler::ErrorReport.new
+      ```
+
+      By using the `chef_handler` resource in a recipe, similar to the following:
+
+      ```ruby
+      chef_handler 'Chef::Handler::ErrorReport' do
+        source 'chef/handler/error_report'
+        action :enable
+      end
+      ```
+      DOC
 
       property :class_name, String,
         description: "The name of the handler class. This can be module name-spaced.",
@@ -50,7 +195,7 @@ class Chef
       # This action needs to find an rb file that presumably contains the indicated class in it and the
       # load that file. It then instantiates that class by name and registers it as a handler.
       action :enable do
-        description "Enables the handler for the current #{Chef::Dist::PRODUCT} run on the current node"
+        description "Enables the handler for the current #{ChefUtils::Dist::Infra::PRODUCT} run on the current node"
 
         class_name = new_resource.class_name
         new_resource.type.each do |type, enable|
@@ -74,7 +219,7 @@ class Chef
       end
 
       action :disable do
-        description "Disables the handler for the current #{Chef::Dist::PRODUCT} run on the current node"
+        description "Disables the handler for the current #{ChefUtils::Dist::Infra::PRODUCT} run on the current node"
 
         new_resource.type.each_key do |type|
           unregister_handler(type, new_resource.class_name)